I think there are two options : the application is sending its logs to a central location (something like this should do it: https://github.com/danielwegener/logback-kafka-appender)

The other option is to scrape all the instance to read their logs (if I am not wrong splunk does it - it could call our new endpoint from this example)